Agent Envelope Mcp

io.github.BlackBoxEngineeringv1.0.1更新於 Sep 29, 2026

Neutral MCP server for AgentEnvelope authority: sovereign verify + vault verify/lookup/mint.

已驗證STDIO僅桌面Cloud & Infrastructure

安裝

在 SourceWeft 中

開啟儀表板中的 Agent Envelope Mcp，將其新增到工作區。
為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照儲存庫中的啟動說明。

README

agent-envelope-mcp

[agent-envelope-mcp MCP server]

agent-envelope-mcp is the MCP adapter for AgentEnvelope.

Any MCP-capable runtime can check delegated authority before it acts: OpenAI Agents SDK, OpenAI Responses remote MCP, Claude Desktop, Cursor, LangChain, LangGraph, CrewAI, or a custom runtime.

Prompts can request actions; AgentEnvelope decides whether the actor has authority to perform them.

Choose Your Mode

Local stdio:

Streamable HTTP:

The HTTP endpoint is:

Health check:

No API key is needed to start the server or to use sovereign signature/record verification. Hosted-governance tools require AE_API_KEY or, in HTTP mode, an Authorization: Bearer <portal-api-key> header.

For verification-only deployments, set AE_TOOLS=readonly. In that mode the server does not register ae_mint, so MCP clients can only call sovereign verification and hosted read/query tools.

Tools

Tool	Mode	Credential	Notes
`ae_verify_sovereign`	Sovereign signature check	none	Offline signature-only check
`ae_verify_sovereign_record`	Sovereign public-record check	none	Offline record, signature, index, and time-decay check
`ae_get_agent`	Hosted governance	`AE_API_KEY` or bearer	Fetches hosted public agent record
`ae_verify_action`	Hosted governance	`AE_API_KEY` or bearer	Verifies against hosted public record
`ae_authorize_action`	Hosted governance	`AE_API_KEY` or bearer	Normalizes hosted verification into an `allowed`/`denied` decision
`ae_get_delegate`	Hosted governance	`AE_API_KEY` or bearer	Fetches one active hosted delegate
`ae_check_legitimacy`	Hosted governance	`AE_API_KEY` or bearer	Normalizes legitimacy state into a decision
`ae_mint`	Hosted governance	`AE_API_KEY` or bearer	Governed mint request; returns receipt, not private material. Omitted when `AE_TOOLS=readonly`

Most tools return both readable MCP content and machine-readable structuredContent.

Runtime Rule

Call AgentEnvelope before the real action. Execute only if allowed === true.

const decision = await authorizeAction(input);
if (decision.allowed !== true) {  throw new Error(decision.message || decision.reason);}
await executeRealTool(input);

const decision = await authorizeAction(input);
if (decision.allowed !== true) {  throw new Error(decision.message || decision.reason);}
await executeRealTool(input);

Do not pass AE_MINT_MATERIAL, vault roots, seeds, or private domain material to the model or MCP client. Keep those in the bot runtime secret store.

Local MCP Config

jsonc

{  "mcpServers": {    "agent-envelope": {      "command": "npx",      "args": ["-y", "agent-envelope-mcp"],      "env": {        "AE_API_KEY": "your-portal-issued-api-key"      }    }  }}

{  "mcpServers": {    "agent-envelope": {      "command": "npx",      "args": ["-y", "agent-envelope-mcp"],      "env": {        "AE_API_KEY": "your-portal-issued-api-key"      }    }  }}

OpenAI Agents SDK

import { Agent, MCPServerStdio, run } from "@openai/agents";
const ae = new MCPServerStdio({  name: "agent-envelope",  fullCommand: "npx -y agent-envelope-mcp",  env: {    AE_API_KEY: process.env.AE_API_KEY  }});
await ae.connect();
const agent = new Agent({  name: "Support Agent",  instructions:    "Before executing any real action, verify authority with AgentEnvelope MCP. Treat failed verification as a hard denial.",  mcpServers: [ae]});
const result = await run(agent, "Can I issue a refund on order ORD-123?");console.log(result.finalOutput);
await ae.close();

import { Agent, MCPServerStdio, run } from "@openai/agents";
const ae = new MCPServerStdio({  name: "agent-envelope",  fullCommand: "npx -y agent-envelope-mcp",  env: {    AE_API_KEY: process.env.AE_API_KEY  }});
await ae.connect();
const agent = new Agent({  name: "Support Agent",  instructions:    "Before executing any real action, verify authority with AgentEnvelope MCP. Treat failed verification as a hard denial.",  mcpServers: [ae]});
const result = await run(agent, "Can I issue a refund on order ORD-123?");console.log(result.finalOutput);
await ae.close();

OpenAI Responses Remote MCP

Use Streamable HTTP mode locally, or point OpenAI at your deployed MCP URL after the web/API edge is configured to serve the MCP HTTP endpoint:

const response = await client.responses.create({  model: process.env.OPENAI_MODEL || "gpt-5",  input: "Check authority before issuing a refund.",  tools: [    {      type: "mcp",      server_label: "agent_envelope",      server_description:        "AgentEnvelope verifies delegated authority for agent actions before execution.",      server_url: process.env.AE_MCP_SERVER_URL,      authorization: process.env.AE_API_KEY,      allowed_tools: [        "ae_authorize_action",        "ae_verify_sovereign_record",        "ae_verify_action"      ],      require_approval: {        never: {          toolNames: [            "ae_verify_sovereign",            "ae_verify_sovereign_record",            "ae_get_agent",            "ae_verify_action",            "ae_authorize_action",            "ae_check_legitimacy"          ]        },        always: {          toolNames: ["ae_mint"]        }      }    }  ]});

const response = await client.responses.create({  model: process.env.OPENAI_MODEL || "gpt-5",  input: "Check authority before issuing a refund.",  tools: [    {      type: "mcp",      server_label: "agent_envelope",      server_description:        "AgentEnvelope verifies delegated authority for agent actions before execution.",      server_url: process.env.AE_MCP_SERVER_URL,      authorization: process.env.AE_API_KEY,      allowed_tools: [        "ae_authorize_action",        "ae_verify_sovereign_record",        "ae_verify_action"      ],      require_approval: {        never: {          toolNames: [            "ae_verify_sovereign",            "ae_verify_sovereign_record",            "ae_get_agent",            "ae_verify_action",            "ae_authorize_action",            "ae_check_legitimacy"          ]        },        always: {          toolNames: ["ae_mint"]        }      }    }  ]});

For local HTTP testing, start the server:

Then use:

LangChain / LangGraph

import { MultiServerMCPClient } from "@langchain/mcp-adapters";import { createAgent } from "langchain";
const client = new MultiServerMCPClient({  "agent-envelope": {    transport: "stdio",    command: "npx",    args: ["-y", "agent-envelope-mcp"],    env: {      AE_API_KEY: process.env.AE_API_KEY    }  }});
const tools = await client.getTools();
const agent = createAgent({  model: process.env.OPENAI_MODEL || "openai:gpt-5",  tools});
const response = await agent.invoke({  messages: [    {      role: "user",      content: "Verify whether this bot can issue a refund before doing anything."    }  ]});

import { MultiServerMCPClient } from "@langchain/mcp-adapters";import { createAgent } from "langchain";
const client = new MultiServerMCPClient({  "agent-envelope": {    transport: "stdio",    command: "npx",    args: ["-y", "agent-envelope-mcp"],    env: {      AE_API_KEY: process.env.AE_API_KEY    }  }});
const tools = await client.getTools();
const agent = createAgent({  model: process.env.OPENAI_MODEL || "openai:gpt-5",  tools});
const response = await agent.invoke({  messages: [    {      role: "user",      content: "Verify whether this bot can issue a refund before doing anything."    }  ]});

Prompt Escalation Pattern

Example attack:

Expected runtime flow:

The model proposes or attempts the action.
The runtime calls ae_authorize_action.
AgentEnvelope returns allowed: false.
The runtime blocks execution.
The hosted or local verification report records the denial.

Denied actions are useful outcomes: they show that authority boundaries held.

Programmatic Use

import { createServer, startHttp } from "agent-envelope-mcp";
// Mount createServer() on your own MCP transport, or:await startHttp({ port: 8787, host: "127.0.0.1", path: "/mcp" });

import { createServer, startHttp } from "agent-envelope-mcp";
// Mount createServer() on your own MCP transport, or:await startHttp({ port: 8787, host: "127.0.0.1", path: "/mcp" });

Environment

Variable	Required for	Purpose
`AE_API_KEY`	Hosted tools	Portal-issued API key for hosted governance
`AE_API_BASE_URL`	Hosted tools	Optional override for the AgentEnvelope hosted API
`AE_TOOLS`	Tool exposure	Set to `readonly` to omit `ae_mint`
`AE_MCP_SESSION_IDLE_MS`	HTTP mode	Optional idle timeout for Streamable HTTP sessions; defaults to 30 minutes
`PORT`	HTTP mode	Default HTTP port when `--port` is omitted
`HOST`	HTTP mode	Default HTTP bind host when `--host` is omitted
`MCP_PATH`	HTTP mode	Default MCP path when `--path` is omitted

Security Notes

Verification-only tools are annotated as read-only.
ae_mint is annotated as a governed, non-idempotent hosted action.
API keys meter service access; signatures prove authority.
The runtime keeps secrets. The model asks for authority; AgentEnvelope returns the decision.
Never expose mint material, vault roots, seeds, or private domain-scoped authority material to the model.

License

Apache-2.0 - see NOTICE for attribution.

來源：README.md，提交 f8799da

工具

工具後設資料尚未被收錄。

版本歷史

v1.0.1最新Sep 16, 2026